-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathindex.html
More file actions
242 lines (242 loc) · 24.9 KB
/
Copy pathindex.html
File metadata and controls
242 lines (242 loc) · 24.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>C++ Profiles: language-level safety</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500&family=Source+Sans+3:wght@400;600;700&family=Source+Serif+4:opsz,wght@8..60,500;8..60,600;8..60,700&display=swap" rel="stylesheet">
<style>
:root{
--bg:#f7f8fa;
--ink:#1f2328;
--accent:#0d6cd1;
--navy:#1b3a5c;
--rule:#e2e6eb;
--display:"Source Serif 4",Georgia,serif;
--sans:"Source Sans 3",sans-serif;
}
*{box-sizing:border-box;margin:0;padding:0;}
html{background:var(--bg);}
body{color:var(--ink);font-family:var(--sans);}
/* watermark: tune --wm-opacity (or .wm-layer opacity) to taste */
:root{--wm-opacity:0.17;}
body::before{content:"";position:fixed;inset:0;z-index:-1;pointer-events:none;background:url("photos/watermark.png") no-repeat right -20px bottom -40px;background-size:auto min(96vh,1100px);opacity:var(--wm-opacity);}
a{color:var(--accent);text-decoration:none;}
.wrap{width:min(1080px,100%);margin:0 auto;padding:0 28px;}
.top{display:flex;align-items:center;justify-content:space-between;height:52px;border-bottom:1px solid var(--rule);}
.brand{display:flex;align-items:center;gap:9px;font-weight:800;font-size:16px;letter-spacing:-.02em;line-height:1.1;}
.brand .mark{width:26px;height:26px;flex:none;display:block;}
.brand small{display:block;font-weight:600;font-size:9px;letter-spacing:.16em;text-transform:uppercase;opacity:.55;}
.lnks{display:flex;gap:20px;font-size:13px;font-weight:500;}
.lnks .is{box-shadow:inset 0 -2px 0 var(--accent);}
.hero{display:grid;grid-template-columns:1fr auto;gap:24px;align-items:center;padding:22px 0 16px;border-bottom:1px solid var(--rule);}
.hero h1{font-family:var(--display);font-size:38px;line-height:1.06;font-weight:700;letter-spacing:-.02em;margin-bottom:10px;}
.hero .lead{font-size:16px;line-height:1.45;max-width:48ch;opacity:.84;margin-bottom:14px;}
.faces{display:grid;grid-template-columns:96px 96px;gap:10px;}
.faces figure{margin:0;}
.faces img{width:100%;aspect-ratio:1;object-fit:cover;object-position:top center;display:block;background:#e2e6eb;border-radius:50%;}
.faces figcaption{padding-top:6px;}
.faces strong{display:block;font-size:11px;}
.faces span{display:block;font-size:10px;opacity:.65;line-height:1.3;}
pre.code{background:#1e293b;color:#e2e8f0;font:12px/1.55 "IBM Plex Mono",ui-monospace,monospace;padding:14px 16px;overflow:auto;}
pre.code .cm{color:#64748b;} pre.code .kw{color:#c084fc;} pre.code .ty{color:#38bdf8;} pre.code .fn{color:#67e8f9;}
.quote{padding:14px 0;text-align:center;border-bottom:1px solid var(--rule);}
.quote .mark{font-family:var(--display);font-size:56px;line-height:.35;color:var(--accent);display:block;margin-bottom:8px;}
.quote blockquote{font-family:var(--display);font-style:italic;font-size:20px;line-height:1.35;max-width:42ch;margin:0 auto 8px;}
.quote cite{font-size:12.5px;opacity:.7;font-style:normal;}
.sec{padding:16px 0;border-bottom:1px solid var(--rule);}
.sec h2{font-family:var(--display);font-size:26px;margin-bottom:10px;}
table.papers{width:100%;border-collapse:collapse;font-size:13.5px;}
table.papers th{text-align:left;font-size:11px;letter-spacing:.12em;text-transform:uppercase;opacity:.55;padding:0 0 8px;border-bottom:2px solid currentColor;}
table.papers td{padding:7px 10px 7px 0;border-bottom:1px solid var(--rule);vertical-align:top;}
table.papers td:first-child{font-weight:700;width:90px;}
table.papers tbody tr:last-child td{border-bottom:none;}
.bib li:last-child{border-bottom:none;}
.ex li:nth-last-child(-n+2){border-bottom:none;}
.who{font-size:11px;opacity:.7;display:flex;align-items:center;gap:6px;margin-top:2px;}
.who img{width:22px;height:22px;border-radius:50%;object-fit:cover;}
.grid2{display:grid;grid-template-columns:1fr 1fr;gap:8px 20px;}
.cardx{padding:8px 0;border-top:1px solid var(--rule);}
.cardx h3{font-size:13px;font-weight:700;margin-bottom:3px;}
.cardx .n{margin-right:6px;font-family:"IBM Plex Mono",monospace;color:var(--accent);opacity:1;}
.cardx p{font-size:12.5px;line-height:1.42;opacity:.92;}
#playground{background:#fff;border:1px solid var(--rule);border-radius:10px;box-shadow:0 1px 2px rgba(27,58,92,.05),0 6px 20px rgba(27,58,92,.06);padding:20px 24px 22px;margin:18px auto;}
.play{display:grid;grid-template-columns:220px 1fr;gap:22px;}
.ex{display:grid;grid-template-columns:1fr 1fr;gap:0 22px;list-style:none;margin-top:8px;}
.ex li{padding:6px 0;border-bottom:1px solid var(--rule);font-size:13px;}
.ex strong{display:block;} .ex span{display:block;font-size:12px;opacity:.65;}
.why{display:grid;grid-template-columns:260px 1fr;gap:24px;}
.why h2{font-style:italic;line-height:1.15;}
.why .orig p{font-size:14px;line-height:1.5;margin-bottom:7px;}
.says{display:grid;grid-template-columns:1fr 1fr 1fr;gap:20px;}
.says blockquote{font-family:var(--display);font-style:italic;font-size:14px;line-height:1.4;margin:6px 0 8px;}
.says cite{font-size:12px;font-style:normal;opacity:.7;}
.foot{display:flex;justify-content:space-between;align-items:center;padding:14px 0 18px;font-size:12px;opacity:.7;}
.quote cite a,.says cite a,.why a{box-shadow:inset 0 -1px 0 rgba(13,108,209,.45);}
.cardx .src{display:block;margin-top:3px;font-family:"IBM Plex Mono",monospace;font-size:10px;letter-spacing:.04em;opacity:.55;}
.bib{list-style:none;font-size:12px;line-height:1.4;}
.bib li{display:grid;grid-template-columns:88px 1fr;gap:12px;padding:5px 0;border-bottom:1px solid var(--rule);}
.bib .id{font-family:"IBM Plex Mono",monospace;font-weight:600;font-size:11.5px;}
.bib .au{display:block;opacity:.6;font-size:11px;}
@media (max-width:800px){.bib li{grid-template-columns:1fr;gap:2px;}}
@media (max-width:800px){
body::before{display:none;}
.ex li:nth-last-child(-n+2){border-bottom:1px solid var(--rule);}
.ex li:last-child{border-bottom:none;}
.hero,.play,.why,.says,.grid2,.ex{grid-template-columns:1fr;}
.faces{grid-template-columns:96px 96px;justify-content:start;}
}
</style>
</head>
<body>
<nav class="top wrap">
<div class="brand"><svg class="mark" viewBox="0 0 32 32" role="img" aria-label="C++ Profiles"><rect width="32" height="32" rx="7" fill="var(--navy)"/><path d="M16 7.4 22.6 9.9v5.3c0 4.1-2.9 7.1-6.6 8.4-3.7-1.3-6.6-4.3-6.6-8.4V9.9z" fill="none" stroke="#fff" stroke-width="1.9" stroke-linejoin="round"/><path d="M12.9 15.7 15.2 18l3.9-4.4" fill="none" stroke="#fff" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"/></svg><span>C++ Profiles<small>Language-level safety</small></span></div>
<div class="lnks"><a class="is" href="#overview">Overview</a><a href="#papers">Papers</a><a href="#playground">Playground</a><a href="#testimonials">Testimonials</a></div>
</nav>
<section class="hero wrap" id="overview">
<div class="intro">
<h1>Making C++ Safe Is Not Optional</h1>
<p class="lead">The Profiles framework brings language-level safety to C++: closing entire classes of undefined behavior at the source, and checking the rest.</p>
</div>
<div class="faces">
<figure>
<img src="photos/gaby.jpg" alt="Gabriel Dos Reis">
<figcaption><strong>Gabriel Dos Reis</strong><span>P3589 · C++ Profiles: The Framework</span></figcaption>
</figure>
<figure>
<img src="photos/bjarne.png" alt="Bjarne Stroustrup">
<figcaption><strong>Bjarne Stroustrup</strong><span>P4222 · initialization profile</span></figcaption>
</figure>
</div>
</section>
<section class="quote wrap">
<span class="mark">“</span>
<blockquote>A program that doesn’t violate the initialization profile runs exactly the same if the profile is enforced or not (or fails to compile if the profile isn’t enforced).</blockquote>
<cite>Bjarne Stroustrup, <a href="https://wg21.link/P4222" target="_blank">“An initialization profile” (P4222)</a></cite>
</section>
<section class="sec wrap">
<h2>Nine aspects of the mechanism</h2>
<div class="grid2">
<article class="cardx"><h3><span class="n">01</span>Initialization</h3><p>Uninitialized reads are among the cheapest defects to write and among the most expensive to diagnose. An initialization profile makes them ill-formed: every object is initialized before it is read, a user-provided constructor must initialize every member, and the static initialization order fiasco becomes a compile error. Where raw storage is required, the hole is named.</p></article>
<article class="cardx"><h3><span class="n">02</span>Bounds, and default-deny</h3><p>A memory-safety profile starts from default-deny: an access is invalid unless the compiler can prove it belongs on the whitelist. When vector’s operator[] carries the bounds rule, every caller inherits the guarantee without annotating the call.</p></article>
<article class="cardx"><h3><span class="n">03</span>Compile-time diagnosis of the common cases</h3><p>“Unprovable in the general case” is not the same as “unaddressable in the cases that dominate production.” Profiles target what the compiler can see. Those cases become ill-formed. The residue is enumerated and handled as runtime.</p></article>
<article class="cardx"><h3><span class="n">04</span>Incremental adoption on existing code</h3><p>Profiles are adopted per translation unit. There is no flag day, and the annotations that are required are local, verifiable, and do not change semantics. A project can enforce initialization in new files this week and leave a device driver on a recorded suppress until it is ready.</p></article>
<article class="cardx"><h3><span class="n">05</span>Named suppression</h3><p>Safety that cannot be locally waived is safety that will be globally disabled. A suppress is named, scoped, and carries a recorded justification. The hole is greppable. Silence is not a dialect.</p></article>
<article class="cardx"><h3><span class="n">06</span>Runtime checking for the remaining core-language UB</h3><p>For the runtime-checkable residue, a profile enumerates the cases, owns the check, and owns the response. The argued default is termination. Continuation past core-language undefined behavior is not the portable guarantee. The goal is not merely to avoid executing past undefined behavior but to eliminate it, which requires that the checks themselves cannot be optimized away by the undefined behavior they guard.</p></article>
<article class="cardx"><h3><span class="n">07</span>A first-class framework, not a configuration preset</h3><p>A profile attests that these rules hold, or the program is ill-formed / does not proceed. That is a different object from a named bundle of switches over someone else’s machinery. A preset only selects from available settings; an attestor can reject the whole program.</p></article>
<article class="cardx"><h3><span class="n">08</span>Localizing the annotation burden</h3><p>Library authors do the local work once; applications consume it. Constructors that must initialize every member, bounds checks that live in operator[], lifetime transitions marked at the allocator boundary: these are the places a profile wants annotations.</p></article>
<article class="cardx"><h3><span class="n">09</span>One meaning across implementations</h3><p>A profile is a portable language rule. The same source, under the same profile, is intended to be ill-formed or well-formed regardless of which vendor compiled it. If two implementations can disagree about whether a safety rule held, users have a vendor option, not a rule.</p></article>
</div>
</section>
<section class="sec wrap" id="papers">
<h2>The Papers</h2>
<table class="papers">
<thead><tr><th>Number</th><th>Title</th><th>Focus Area</th></tr></thead>
<tbody>
<tr><td><a href="https://wg21.link/P3589" target="_blank">P3589</a></td><td>C++ Profiles: The Framework<div class="who"><img src="photos/gaby.jpg" alt="">Gabriel Dos Reis</div></td><td>Framework</td></tr>
<tr><td><a href="https://wg21.link/P3970" target="_blank">P3970</a></td><td>Profiles and Safety: a call to action</td><td>Direction</td></tr>
<tr><td><a href="https://wg21.link/P4222" target="_blank">P4222</a></td><td>An initialization profile</td><td>Initialization</td></tr>
<tr><td><a href="https://wg21.link/P4296" target="_blank">P4296</a></td><td>Default-Deny + Provable-Whitelist Invalidation</td><td>Memory Safety</td></tr>
<tr><td><a href="https://wg21.link/P4297" target="_blank">P4297</a></td><td>Severing P3100’s Profiles Claim from Its Case-by-Case Review</td><td>Architecture</td></tr>
<tr><td><a href="https://wg21.link/P4306" target="_blank">P4306</a></td><td>Configuring Runtime Checking: Profiles and Implicit Contract Assertions</td><td>Configuration</td></tr>
<tr><td><a href="https://wg21.link/P4308" target="_blank">P4308</a></td><td>Eight Responses to a Throwing Implicit Contract Assertion</td><td>Contract Responses</td></tr>
<tr><td><a href="https://wg21.link/P4318" target="_blank">P4318</a></td><td>Transient Benefit, Perpetual Cost: Implicit Core-Language Assertions</td><td>Cost Analysis</td></tr>
<tr><td><a href="https://wg21.link/P4238" target="_blank">P4238</a></td><td>Returning C++26 for the Evaluation It Skipped</td><td>Process</td></tr>
</tbody>
</table>
</section>
<section class="sec wrap" id="playground">
<div class="play">
<div>
<h2>Try the Code</h2>
<p style="opacity:.75;font-size:14px;line-height:1.45;margin-bottom:8px;">Eight worked examples of the initialization profile, live on Compiler Explorer.</p>
<p style="font-size:12px;opacity:.55;">Profiles-enabled Clang · <code>-std=c++23 -fprofiles</code></p>
</div>
<div>
<pre class="code"><span class="cm">// std::init: every object is initialized before it is read.</span>
[[<span class="ty">profiles</span>::<span class="fn">enforce</span>(<span class="ty">std</span>::<span class="ty">init</span>)]];
<span class="kw">struct</span> <span class="ty">Options</span> { <span class="kw">int</span> timeout_ms; <span class="kw">bool</span> verbose; };
<span class="kw">int</span> <span class="fn">run</span>(<span class="kw">int</span> argc, <span class="kw">const</span> <span class="kw">char</span> **argv) {
<span class="ty">Options</span> opts; <span class="cm">// error: indeterminate</span>
<span class="kw">int</span> retries; <span class="cm">// error: uninitialized</span>
<span class="kw">return</span> opts.timeout_ms * retries;
}</pre>
<ul class="ex">
<li><strong><a href="https://godbolt.org/z/n3TPjbqdY" target="_blank">Basics</a></strong><span>Every object initialized before it is read</span></li>
<li><strong><a href="https://godbolt.org/z/v796exxeh" target="_blank">Constructors</a></strong><span>A user-provided constructor must initialize every member</span></li>
<li><strong><a href="https://godbolt.org/z/ahTcd863v" target="_blank">Static initialization</a></strong><span>The static initialization order fiasco, as a compile error</span></li>
<li><strong><a href="https://godbolt.org/z/bW8q89Yce" target="_blank"><code>[[uninit]]</code></a></strong><span>Skip the zeroing without giving up the guarantee</span></li>
<li><strong><a href="https://godbolt.org/z/7b6hfznxW" target="_blank"><code>[[ref_to_uninit]]</code></a></strong><span>Tell raw storage apart from live objects, at every call site</span></li>
<li><strong><a href="https://godbolt.org/z/d6czYM7ad" target="_blank"><code>[[now_init]]</code> / <code>[[now_uninit]]</code></a></strong><span>The construct/destroy cycle, checked at compile time</span></li>
<li><strong><a href="https://godbolt.org/z/K76qWGd44" target="_blank">Profile suppression</a></strong><span>Per-rule opt-outs that carry a recorded justification</span></li>
<li><strong><a href="https://godbolt.org/z/PjsMKfxYM" target="_blank">Container example</a></strong><span>The annotation burden stays inside the container</span></li>
</ul>
</div>
</div>
</section>
<section class="sec wrap">
<div class="why">
<h2>Why Not Contracts?</h2>
<div class="orig">
<p>Contracts are a valuable tool for documentation, validation, and optimization. But they are not a safety net. Contracts can be disabled, ignored, or forgotten. Safety must not depend on programmer discipline or build modes.</p>
<p>Profiles bake safety into the language rules. They close entire classes of undefined behavior by construction, not convention.</p>
<p>Contracts can describe intent. Profiles guarantee it.</p>
</div>
</div>
<h2 style="margin:16px 0 8px;font-family:var(--display);font-size:22px;">Limits of the alternative</h2>
<div class="grid2">
<article class="cardx"><h3><span class="n">01</span>It can be switched off</h3><p>An alternative that is stripped by a build mode is not a safety net. The person who ships the binary is often not the person who wrote the annotation. Discipline is not a mechanism.<span class="src"><a href="https://wg21.link/P3100" target="_blank">P3100R8</a></span></p></article>
<article class="cardx"><h3><span class="n">02</span>A conforming implementation may do nothing</h3><p>The leading paper for the alternative states that existing implementations are already conforming with its wording transformation. A vendor may treat the new checks as assumptions and generate the same code as today.<span class="src"><a href="https://wg21.link/P3100" target="_blank">P3100R8</a></span></p></article>
<article class="cardx"><h3><span class="n">03</span>Continuation after a language-undefined state</h3><p>Some designs invoke a handler and then continue. At the core-language-undefined class, continuation is execution in a state the language does not define. That is a protocol for living with undefined behavior, not closing it.<span class="src"><a href="https://wg21.link/P4318" target="_blank">P4318R1</a></span></p></article>
<article class="cardx"><h3><span class="n">04</span>Coverage is a fraction of the census</h3><p>By the alternative’s own census, only 20 of 82 enumerated core-undefined-behavior cases are unconditionally locally runtime-checkable. A facility that cannot see most of the problem should not be the substrate every other story sits on.<span class="src"><a href="https://wg21.link/P3100" target="_blank">P3100R8</a></span></p></article>
<article class="cardx"><h3><span class="n">05</span>The static half is declared impossible, then used to close the door</h3><p>The same census concludes that none of the 82 cases can be unconditionally diagnosed at compile time. “Unprovable in general” is not “unaddressable in the common cases.”<span class="src"><a href="https://wg21.link/P3100" target="_blank">P3100R8</a></span></p></article>
<article class="cardx"><h3><span class="n">06</span>Ordinary code can change meaning</h3><p>One documented example flips the result of a well-formed program: noexcept of an expression that would become a core-language check is no longer the noexcept programmers have been writing for a decade.<span class="src"><a href="https://wg21.link/P4308" target="_blank">P4308R1</a></span></p></article>
<article class="cardx"><h3><span class="n">07</span>The menu is not a guarantee</h3><p>The evaluation semantics are selected outside the source, by whoever owns the final build rather than the author of the code. C++26 defines four of them for explicit contract assertions; the proposal adds a fifth, assume, for the implicit assertions that guard core-language undefined behavior, letting the optimizer rely on a condition that was never checked.<span class="src"><a href="https://wg21.link/P4308" target="_blank">P4308R1</a></span></p></article>
<article class="cardx"><h3><span class="n">08</span>Additive wording is not architecturally free</h3><p>Additive at the wording level is how a substrate gets locked. Once every core-language check is routed through a single program-wide handler, every later safety feature inherits that routing.<span class="src"><a href="https://wg21.link/P4297" target="_blank">P4297R1</a></span></p></article>
<article class="cardx"><h3><span class="n">09</span>Predicates are a weak static-analysis surface</h3><p>Arbitrary predicates are attractive in slides and expensive in tools. Existing production analyzers already recover preconditions from ordinary assertions.</p></article>
<article class="cardx"><h3><span class="n">10</span>Cost is paid in the rest of the language</h3><p>A check that can throw can unwind, and unwinding is not free on every ABI. A check treated as an assumption can widen undefined behavior rather than close it. Cost studies leave the largest of these effects for future work.<span class="src"><a href="https://wg21.link/P4318" target="_blank">P4318R1</a></span></p></article>
</div>
</section>
<section class="sec wrap" id="testimonials">
<h2>What They Say</h2>
<div class="says">
<div>
<blockquote>I just want C++ to let me enforce our already-well-known safety rules and best practices by default, and make me opt out explicitly if that’s what I want.</blockquote>
<cite><strong>Herb Sutter</strong><br>Chair, ISO C++ Committee · <a href="https://herbsutter.com/2024/03/11/safety-in-context/" target="_blank">“C++ safety, in context”</a></cite>
</div>
<div>
<blockquote>SG23 and EWG have repeatedly (by massive votes) pointed to “Profiles” as the direction for addressing these urgent needs … The way to make progress is to build on the proposed Profiles framework.</blockquote>
<cite><strong>David Vandevoorde</strong><br>Edison Design Group · lead author, <a href="https://wg21.link/P3970" target="_blank">P3970R0</a></cite>
</div>
<div>
<blockquote>To address the contemporary challenge of memory safety concerns, we need some standard profiles related to type and memory safety, guaranteed to be available in all C++ implementations.</blockquote>
<cite><strong>Gabriel Dos Reis</strong><br>Microsoft · author, <a href="https://wg21.link/P3589" target="_blank">P3589R3</a></cite>
</div>
</div>
</section>
<section class="sec wrap" id="bibliography">
<h2>Bibliography</h2>
<ol class="bib">
<li><span class="id"><a href="https://wg21.link/P3038" target="_blank">P3038R0</a></span><span>Concrete suggestions for initial Profiles<span class="au">Bjarne Stroustrup · 2023-12-16</span></span></li>
<li><span class="id"><a href="https://wg21.link/P3100" target="_blank">P3100R8</a></span><span>A framework for systematically addressing undefined behaviour in the C++ Standard<span class="au">Timur Doumler, Joshua Berne · 2026-08-14</span></span></li>
<li><span class="id"><a href="https://wg21.link/P3589" target="_blank">P3589R3</a></span><span>C++ Profiles: The Framework<span class="au">Gabriel Dos Reis · 2026-07-21</span></span></li>
<li><span class="id"><a href="https://wg21.link/P3970" target="_blank">P3970R0</a></span><span>Profiles and Safety: a call to action<span class="au">David Vandevoorde, Jeff Garland, Paul E. McKenney, Roger Orr, Bjarne Stroustrup, Michael Wong · 2026-02-23</span></span></li>
<li><span class="id"><a href="https://wg21.link/P4222" target="_blank">P4222R2</a></span><span>An initialization profile<span class="au">Bjarne Stroustrup · 2026-08-14</span></span></li>
<li><span class="id"><a href="https://wg21.link/P4238" target="_blank">P4238R0</a></span><span>Returning C++26 for the Evaluation It Skipped<span class="au">Vinnie Falco, Ville Voutilainen, José Daniel García Sánchez, John Spicer · 2026-08-14</span></span></li>
<li><span class="id"><a href="https://wg21.link/P4296" target="_blank">P4296R0</a></span><span>Default-Deny + Provable-Whitelist Invalidation<span class="au">Guy Davidson, Sherry Ignatchenko, Dmytro Ivanchykhin, Marcos Bracco · 2026-07-14</span></span></li>
<li><span class="id"><a href="https://wg21.link/P4297" target="_blank">P4297R1</a></span><span>Severing P3100’s Profiles Claim from Its Case-by-Case Review<span class="au">Vinnie Falco, Ville Voutilainen · 2026-08-14</span></span></li>
<li><span class="id"><a href="https://wg21.link/P4306" target="_blank">P4306R1</a></span><span>Configuring Runtime Checking: Profiles and Implicit Contract Assertions<span class="au">Vinnie Falco, Ville Voutilainen · 2026-08-14</span></span></li>
<li><span class="id"><a href="https://wg21.link/P4308" target="_blank">P4308R1</a></span><span>Eight Responses to a Throwing Implicit Contract Assertion<span class="au">Vinnie Falco, Ville Voutilainen · 2026-08-14</span></span></li>
<li><span class="id"><a href="https://wg21.link/P4318" target="_blank">P4318R1</a></span><span>Transient Benefit, Perpetual Cost: Implicit Core-Language Assertions<span class="au">Vinnie Falco · 2026-08-14</span></span></li>
<li><span class="id"><a href="https://herbsutter.com/2024/03/11/safety-in-context/" target="_blank">Blog</a></span><span>C++ safety, in context<span class="au">Herb Sutter · 2024-03-11</span></span></li>
</ol>
</section>
<footer class="foot wrap">
<div>C++ Profiles</div>
<div>Overview · Papers · Playground · Testimonials</div>
<div>WG21 · 2026</div>
</footer>
</body>
</html>